@fuzdev/fuz_app 0.140.0 → 0.142.0

package/dist/testing/cross_backend/origin_scope.d.ts

@@ -0,0 +1,16 @@
+import '../assert_dev_env.js';
+import type { CapabilityGatedCrossSuiteOptions } from './setup.js';
+/** Options for the origin-scope parity suite. */
+export interface OriginScopeCrossTestOptions extends CapabilityGatedCrossSuiteOptions {
+    /** A public path outside `/api` the backend serves with `200`. Default `/ready`. */
+    readonly probe_path?: string;
+    /**
+     * The backend's base URL, for the over-cap row: given one, the request
+     * head is written to the socket alone, declaring a length one byte over
+     * the cap, so the `413` has to arrive before any body byte. `null` (the
+     * default) sends the whole body through the fixture's in-process transport.
+     */
+    readonly base_url?: string | null;
+}
+export declare const describe_origin_scope_cross_tests: (options: OriginScopeCrossTestOptions) => void;
+//# sourceMappingURL=origin_scope.d.ts.map

package/dist/testing/cross_backend/origin_scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin_scope.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/origin_scope.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAcnE,iDAAiD;AACjD,MAAM,WAAW,2BAA4B,SAAQ,gCAAgC;IACpF,oFAAoF;IACpF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAmGxF,CAAC"}

package/dist/testing/cross_backend/origin_scope.js

@@ -0,0 +1,140 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for the origin check's scope: every path, not
+ * only `/api`.
+ *
+ * Both spines check the `Origin` of every request — the TS spine mounts the
+ * check on every path (`ORIGIN_MIDDLEWARE_PATH`), the Rust spine behind every
+ * route group of `fuz_http::compose_stack`, the fallback included — and leave
+ * a path out only by a named carve-out with its reason. The front-door table
+ * (`transport_composition.ts`) pins the check on the `/api` transports; this
+ * suite pins it off `/api`, on the route both spine test servers serve there,
+ * `GET /ready`:
+ *
+ * - **foreign `Origin` → 403 `forbidden_origin`** — the check runs on a path
+ *   outside `/api`.
+ * - **absent `Origin` → passes** — a probe or CLI client sends none, so the
+ *   wider scope costs it nothing.
+ * - **allowed `Origin` → passes** — the control: the check admits its own
+ *   origin rather than refusing every browser.
+ *
+ * And on a path neither server routes, which reaches each spine's fallback:
+ *
+ * - **foreign `Origin` → 403 `forbidden_origin`**, **absent → 404** — the
+ *   fallback is behind the check, not attached after it.
+ * - **an over-cap `POST` with a declared `Content-Length` and a foreign
+ *   `Origin` → 413 `payload_too_large`** — the body cap comes ahead of the
+ *   origin check on the fallback too (413-first holds for a declared length).
+ *
+ * The `/ready` rows are gated on `capabilities.ready`, which every spine test
+ * server advertises; the unrouted rows run on every backend.
+ * Runs both legs via the shared `{setup_test, capabilities}` protocol: the
+ * in-process leg (`cross_backend/origin_scope_parity.db.test.ts`, plain `gro
+ * test`) and the cross-process leg (`cross_backend/origin_scope.cross.test.ts`,
+ * the TS spine binaries + Rust `testing_spine_stub` over real HTTP).
+ *
+ * @module
+ */
+import { describe, assert, test } from 'vitest';
+import { ERROR_FORBIDDEN_ORIGIN, ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
+import { raw_http_exchange, raw_http_parse_response } from '../transports/raw_http.js';
+import { test_if } from './capabilities.js';
+/** An origin no spine test server allows. */
+const FOREIGN_ORIGIN = 'https://evil.example';
+/** A path no spine test server routes — it reaches the fallback. */
+const UNROUTED_PATH = '/origin-scope-unrouted';
+/** The shared 1 MiB default cap both spines ship, as in `body_size.ts`. */
+const BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
+/** How long a raw exchange waits for the refusal. */
+const RAW_READ_TIMEOUT_MS = 2000;
+export const describe_origin_scope_cross_tests = (options) => {
+    const { setup_test, capabilities } = options;
+    const probe_path = options.probe_path ?? '/ready';
+    const base_url = options.base_url ?? null;
+    describe('origin check scope parity', () => {
+        test_if(capabilities.ready, `a foreign Origin on ${probe_path} → 403 forbidden_origin (the check covers every path)`, async () => {
+            const fixture = await setup_test();
+            // the header set on the request, not as the transport's default — an
+            // in-process transport sends no default Origin
+            const res = await fixture.fresh_transport({ origin: null })(probe_path, {
+                method: 'GET',
+                headers: { origin: FOREIGN_ORIGIN }
+            });
+            assert.strictEqual(res.status, 403, 'a foreign Origin off /api must be refused');
+            const body = (await res.json().catch(() => undefined));
+            assert.strictEqual(body?.error, ERROR_FORBIDDEN_ORIGIN);
+        });
+        test_if(capabilities.ready, `an absent Origin on ${probe_path} → passes`, async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport({ origin: null })(probe_path, { method: 'GET' });
+            assert.strictEqual(res.status, 200, 'a request with no Origin must pass the check');
+        });
+        test_if(capabilities.ready, `the allowed Origin on ${probe_path} → passes`, async () => {
+            const fixture = await setup_test();
+            // a cross-process transport sends the backend's own, allowed Origin by
+            // default (an in-process one sends none, which passes too)
+            const res = await fixture.fresh_transport()(probe_path, { method: 'GET' });
+            assert.strictEqual(res.status, 200, 'the allowed Origin must pass the check');
+        });
+        test(`a foreign Origin on an unrouted path → 403 forbidden_origin (the fallback is checked)`, async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport({ origin: null })(UNROUTED_PATH, {
+                method: 'GET',
+                headers: { origin: FOREIGN_ORIGIN }
+            });
+            assert.strictEqual(res.status, 403, 'a foreign Origin on the fallback must be refused');
+            const body = (await res.json().catch(() => undefined));
+            assert.strictEqual(body?.error, ERROR_FORBIDDEN_ORIGIN);
+        });
+        test('an absent Origin on an unrouted path → 404', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport({ origin: null })(UNROUTED_PATH, {
+                method: 'GET'
+            });
+            assert.strictEqual(res.status, 404, 'the fallback answers its own 404 past the check');
+        });
+        test('an over-cap POST to an unrouted path with a foreign Origin → 413 payload_too_large', async () => {
+            const over = BODY_LIMIT_DEFAULT_BYTES + 1;
+            let status;
+            let text;
+            if (base_url === null) {
+                const fixture = await setup_test();
+                const res = await fixture.fresh_transport({ origin: null })(UNROUTED_PATH, {
+                    method: 'POST',
+                    headers: { origin: FOREIGN_ORIGIN, 'content-type': 'application/json' },
+                    body: 'x'.repeat(over)
+                });
+                status = res.status;
+                text = await res.text();
+            }
+            else {
+                // the head alone, declaring the length: the 413 must not wait on a body byte
+                const url = new URL(base_url);
+                const request = `POST ${UNROUTED_PATH} HTTP/1.1\r\n` +
+                    `host: ${url.host}\r\n` +
+                    `origin: ${FOREIGN_ORIGIN}\r\n` +
+                    `content-type: application/json\r\n` +
+                    `content-length: ${over}\r\n` +
+                    `\r\n`;
+                const { received } = await raw_http_exchange(base_url, request, {
+                    read_timeout_ms: RAW_READ_TIMEOUT_MS,
+                    until: 'response'
+                });
+                const response = raw_http_parse_response(received);
+                assert.ok(response, `no whole response; received: ${received.slice(0, 200)}`);
+                status = response.status;
+                text = response.body;
+            }
+            assert.strictEqual(status, 413, `the cap comes ahead of the origin check (body: ${text})`);
+            const body = (() => {
+                try {
+                    return JSON.parse(text);
+                }
+                catch {
+                    return undefined;
+                }
+            })();
+            assert.strictEqual(body?.error, ERROR_PAYLOAD_TOO_LARGE);
+        });
+    });
+};

package/dist/testing/cross_backend/query_shape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/query_shape.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAQjF,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAwHtF,CAAC"}
+{"version":3,"file":"query_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/query_shape.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAQjF,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAkJtF,CAAC"}

package/dist/testing/cross_backend/query_shape.js

@@ -12,8 +12,9 @@ import '../assert_dev_env.js';
  * pinned here on both backends:
  *
  * - **`GET /api/account/status`** — NO query schema: a duplicated `acting`
- *   reads first-wins (the persona resolves), unknown keys are ignored, and an
- *   anonymous caller with junk query hears 401, never a query 400.
+ *   reads first-wins (the persona resolves), a malformed `acting` answers
+ *   account-only (never a default-actor resolve), unknown keys are ignored,
+ *   and an anonymous caller with junk query hears 401, never a query 400.
  * - **the JSON-RPC GET endpoint** — `method` / `id` / `params` read
  *   first-wins; a duplicated `method` must dispatch the first one on every
  *   backend (a last-wins reader dispatches a different method per backend on
@@ -55,6 +56,27 @@ export const describe_query_shape_cross_tests = (options) => {
             const body = (await res.json());
             assert.strictEqual(body.actor?.id, fixture.actor.id, 'first acting occurrence must win');
         });
+        test_if(capabilities.account_status, 'status: a malformed acting is a missing persona, not a default-actor resolve', async () => {
+            const fixture = await setup_test();
+            // The keeper has one actor: an omitted selector resolves it, while a
+            // malformed one answers account-only.
+            const omitted = await fixture.transport(STATUS_PATH, {
+                method: 'GET',
+                headers: fixture.create_session_headers()
+            });
+            assert.strictEqual(omitted.status, 200);
+            const omitted_body = (await omitted.json());
+            assert.strictEqual(omitted_body.actor?.id, fixture.actor.id);
+            for (const raw of ['not-a-uuid', '', `"${fixture.actor.id}"`]) {
+                const res = await fixture.transport(`${STATUS_PATH}?acting=${encodeURIComponent(raw)}`, {
+                    method: 'GET',
+                    headers: fixture.create_session_headers()
+                });
+                assert.strictEqual(res.status, 200, raw);
+                const body = (await res.json());
+                assert.strictEqual(body.actor, null, raw);
+            }
+        });
         test_if(capabilities.account_status, 'status: anonymous with duplicated/unknown query keys → 401, never a query 400', async () => {
             const fixture = await setup_test();
             const anon = fixture.fresh_transport();

package/dist/testing/cross_backend/role_grant_cross_helpers.d.ts

@@ -0,0 +1,35 @@
+import '../assert_dev_env.js';
+import type { TestAccountFixture, TestFixture } from './setup.js';
+/** Options for the role-grant fixtures. */
+export interface RoleGrantFixtureOptions {
+    /** The role to offer. Default `ROLE_ADMIN`, the one builtin admin-grantable role. */
+    readonly role?: string;
+    /** The JSON-RPC endpoint path. Default `SPINE_RPC_PATH`. */
+    readonly rpc_path?: string;
+}
+/**
+ * Create a fresh pending offer of `role` from `grantor_headers` (defaults to
+ * the keeper) to `to_account_id`, returning the created offer.
+ *
+ * @param fixture - the per-test fixture
+ * @param to_account_id - the recipient account
+ * @param grantor_headers - the grantor's session headers; the keeper's when omitted
+ * @param options - the role and the RPC path
+ * @returns the created offer
+ */
+export declare const create_pending_role_grant_offer: (fixture: TestFixture, to_account_id: string, grantor_headers?: Record<string, string>, options?: RoleGrantFixtureOptions) => Promise<{
+    id: string;
+}>;
+/**
+ * Materialize an active global grant of `role` on `recipient` through a fresh
+ * keeper offer and the recipient's accept, returning its `role_grant_id` — the
+ * handle `role_grant_revoke` keys on. Idempotent on a grant the account
+ * already holds: the accept returns that grant's id.
+ *
+ * @param fixture - the per-test fixture
+ * @param recipient - the account that accepts the offer
+ * @param options - the role and the RPC path
+ * @returns the active grant's id
+ */
+export declare const create_active_role_grant: (fixture: TestFixture, recipient: TestAccountFixture, options?: RoleGrantFixtureOptions) => Promise<string>;
+//# sourceMappingURL=role_grant_cross_helpers.d.ts.map

package/dist/testing/cross_backend/role_grant_cross_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role_grant_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoB9B,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElE,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACvC,qFAAqF;IACrF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,GAC3C,SAAS,WAAW,EACpB,eAAe,MAAM,EACrB,kBAAiB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAoC,EAC1E,UAAS,uBAA4B,KACnC,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAWxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GACpC,SAAS,WAAW,EACpB,WAAW,kBAAkB,EAC7B,UAAS,uBAA4B,KACnC,OAAO,CAAC,MAAM,CAgBhB,CAAC"}

package/dist/testing/cross_backend/role_grant_cross_helpers.js

@@ -0,0 +1,64 @@
+import '../assert_dev_env.js';
+/**
+ * Role-grant fixtures for the cross-process suites — a pending offer, and an
+ * active grant materialized through the real offer + accept handlers — shared
+ * by the suites that need a grant to revoke
+ * (`describe_role_grant_offer_notification_ws_tests`,
+ * `describe_ws_role_gated_cross_tests`).
+ *
+ * Both drive the standard role-grant-offer RPC actions over the fixture's
+ * HTTP transport, as the keeper unless a grantor is given.
+ *
+ * @module
+ */
+import { assert } from 'vitest';
+import { rpc_call } from '../rpc_helpers.js';
+import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/**
+ * Create a fresh pending offer of `role` from `grantor_headers` (defaults to
+ * the keeper) to `to_account_id`, returning the created offer.
+ *
+ * @param fixture - the per-test fixture
+ * @param to_account_id - the recipient account
+ * @param grantor_headers - the grantor's session headers; the keeper's when omitted
+ * @param options - the role and the RPC path
+ * @returns the created offer
+ */
+export const create_pending_role_grant_offer = async (fixture, to_account_id, grantor_headers = fixture.create_session_headers(), options = {}) => {
+    const { role = ROLE_ADMIN, rpc_path = SPINE_RPC_PATH } = options;
+    const res = await rpc_call({
+        app: fixture.transport,
+        path: rpc_path,
+        method: 'role_grant_offer_create',
+        params: { to_account_id, role },
+        headers: grantor_headers
+    });
+    if (!res.ok)
+        assert.fail(`offer create failed: ${JSON.stringify(res)}`);
+    return res.result.offer;
+};
+/**
+ * Materialize an active global grant of `role` on `recipient` through a fresh
+ * keeper offer and the recipient's accept, returning its `role_grant_id` — the
+ * handle `role_grant_revoke` keys on. Idempotent on a grant the account
+ * already holds: the accept returns that grant's id.
+ *
+ * @param fixture - the per-test fixture
+ * @param recipient - the account that accepts the offer
+ * @param options - the role and the RPC path
+ * @returns the active grant's id
+ */
+export const create_active_role_grant = async (fixture, recipient, options = {}) => {
+    const offer = await create_pending_role_grant_offer(fixture, recipient.account.id, fixture.create_session_headers(), options);
+    const accepted = await rpc_call({
+        app: fixture.transport,
+        path: options.rpc_path ?? SPINE_RPC_PATH,
+        method: 'role_grant_offer_accept',
+        params: { offer_id: offer.id },
+        headers: recipient.create_session_headers()
+    });
+    if (!accepted.ok)
+        assert.fail(`accept failed: ${JSON.stringify(accepted)}`);
+    return accepted.result.role_grant_id;
+};

package/dist/testing/cross_backend/role_grant_offer_notification_ws.d.ts

@@ -11,6 +11,14 @@ export interface RoleGrantOfferNotificationWsTestOptions {
     readonly base_url: string;
     /** WebSocket endpoint path on the backend (e.g. `/api/ws`). */
     readonly ws_path: string;
+    /**
+     * The roles `ws_path` gates its upgrade on (its `required_roles`), or
+     * omitted / `[]` for an ungated endpoint. Declare them for a backend whose
+     * socket is role-gated: revoking `ROLE_ADMIN` then closes the revokee's
+     * socket with `WS_CLOSE_PERMISSION_REVOKED`, and the revoke case asserts
+     * that close instead of the notification frame.
+     */
+    readonly ws_required_roles?: ReadonlyArray<string>;
 }
 /**
  * Register the role-grant-offer WS notification suite — seven cases over a real

package/dist/testing/cross_backend/role_grant_offer_notification_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_notification_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_notification_ws.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqE9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAmC,MAAM,YAAY,CAAC;AAK7E,2EAA2E;AAC3E,MAAM,WAAW,uCAAuC;IACvD,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+CAA+C,GAC3D,SAAS,uCAAuC,KAC9C,IAuWF,CAAC"}
+{"version":3,"file":"role_grant_offer_notification_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_notification_ws.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4E9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AAKtE,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAKzD,2EAA2E;AAC3E,MAAM,WAAW,uCAAuC;IACvD,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+CAA+C,GAC3D,SAAS,uCAAuC,KAC9C,IA6VF,CAAC"}

package/dist/testing/cross_backend/role_grant_offer_notification_ws.js

@@ -38,6 +38,12 @@ import '../assert_dev_env.js';
  * guard), and accept stays idempotent on the role_grant while still superseding
  * pending siblings. Gated on `capabilities.ws`.
  *
+ * The revoke case revokes the revokee's only `ROLE_ADMIN` grant. On an endpoint
+ * gated on that role (`ws_required_roles`) the revokee's socket loses its
+ * access by the same revoke: it is closed with `WS_CLOSE_PERMISSION_REVOKED`,
+ * and the notification may or may not reach it first (nothing orders the two),
+ * so the case asserts the close there and the frame on an ungated endpoint.
+ *
  * Cross-process only: `create_admitted_ws_transport` needs a real bound socket, so wire
  * it from a `*.cross.test.ts` file, never an in-process setup. Authed cookies
  * come from the per-account session minted by `fixture.create_account` /
@@ -50,8 +56,10 @@ import { rpc_call } from '../rpc_helpers.js';
 import { create_admitted_ws_transport } from '../transports/ws_transport.js';
 import { is_notification_with } from '../transports/ws_client.js';
 import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { WS_CLOSE_PERMISSION_REVOKED } from '../../actions/transports.js';
 import { ROLE_GRANT_OFFER_RECEIVED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_ACCEPTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_DECLINED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_RETRACTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_SUPERSEDE_NOTIFICATION_METHOD, ROLE_GRANT_REVOKE_NOTIFICATION_METHOD, RoleGrantOfferReceivedParams, RoleGrantOfferAcceptedParams, RoleGrantOfferDeclinedParams, RoleGrantOfferRetractedParams, RoleGrantOfferSupersedeParams, RoleGrantRevokeParams } from '../../auth/role_grant_offer_notifications.js';
 import { test_if } from './capabilities.js';
+import { create_active_role_grant, create_pending_role_grant_offer } from './role_grant_cross_helpers.js';
 /** JSON-RPC endpoint path — matches the spine's `/api/rpc` (and the forge's). */
 const RPC_PATH = '/api/rpc';
 /**
@@ -63,7 +71,8 @@ const RPC_PATH = '/api/rpc';
  * params schema. Gated on `capabilities.ws`.
  */
 export const describe_role_grant_offer_notification_ws_tests = (options) => {
-    const { setup_test, capabilities, base_url, ws_path } = options;
+    const { setup_test, capabilities, base_url, ws_path, ws_required_roles = [] } = options;
+    const revoke_closes_the_socket = ws_required_roles.includes(ROLE_ADMIN);
     // -- shared helpers -------------------------------------------------------
     /**
      * Open a WS transport for a single session cookie (`<name>=<value>`),
@@ -81,29 +90,10 @@ export const describe_role_grant_offer_notification_ws_tests = (options) => {
     };
     /** Drive a JSON-RPC call over the fixture's HTTP transport. */
     const rpc = (fixture, method, params, headers) => rpc_call({ app: fixture.transport, path: RPC_PATH, method, params, headers });
-    /**
-     * Create a fresh pending `ROLE_ADMIN` offer from `grantor_headers` (defaults
-     * to the keeper) to `to_account_id`, returning the created offer.
-     */
-    const create_pending_offer = async (fixture, to_account_id, grantor_headers = fixture.create_session_headers()) => {
-        const res = await rpc(fixture, 'role_grant_offer_create', { to_account_id, role: ROLE_ADMIN }, grantor_headers);
-        if (!res.ok)
-            assert.fail(`offer create failed: ${JSON.stringify(res)}`);
-        return res.result.offer;
-    };
-    /**
-     * Materialize an active `ROLE_ADMIN` role_grant on `recipient` via a fresh
-     * keeper offer + recipient accept (idempotent on a grant the account already
-     * holds), returning its `role_grant_id` — the handle `role_grant_revoke`
-     * keys on.
-     */
-    const create_active_role_grant = async (fixture, recipient) => {
-        const offer = await create_pending_offer(fixture, recipient.account.id);
-        const accepted = await rpc(fixture, 'role_grant_offer_accept', { offer_id: offer.id }, recipient.create_session_headers());
-        if (!accepted.ok)
-            assert.fail(`accept failed: ${JSON.stringify(accepted)}`);
-        return accepted.result.role_grant_id;
-    };
+    /** A fresh pending `ROLE_ADMIN` offer, from the keeper unless a grantor is given. */
+    const create_pending_offer = (fixture, to_account_id, grantor_headers) => create_pending_role_grant_offer(fixture, to_account_id, grantor_headers, {
+        rpc_path: RPC_PATH
+    });
     // -- tests ----------------------------------------------------------------
     describe('role_grant_offer WS notifications (cross-process)', () => {
         test_if(capabilities.ws, 'an offer create delivers role_grant_offer_received to the recipient WS', async () => {
@@ -187,22 +177,41 @@ export const describe_role_grant_offer_notification_ws_tests = (options) => {
                 await recipient_ws.close();
             }
         });
-        test_if(capabilities.ws, 'revoke delivers a flat role_grant_revoke to the revokee WS', async () => {
+        test_if(capabilities.ws, revoke_closes_the_socket
+            ? 'revoke closes the revokee WS gated on the revoked role'
+            : 'revoke delivers a flat role_grant_revoke to the revokee WS', async () => {
             const fixture = await setup_test();
             const revokee = await fixture.create_account({ roles: [ROLE_ADMIN] });
-            const role_grant_id = await create_active_role_grant(fixture, revokee);
+            const role_grant_id = await create_active_role_grant(fixture, revokee, {
+                rpc_path: RPC_PATH
+            });
             const revokee_ws = await open_ws(revokee.create_session_headers().cookie);
             try {
                 const revoked = await rpc(fixture, 'role_grant_revoke', { actor_id: revokee.actor.id, role_grant_id, reason: 'cleanup' }, fixture.create_session_headers());
                 assert.isTrue(revoked.ok, `revoke failed: ${JSON.stringify(revoked)}`);
-                const frame = await revokee_ws.wait_for(is_notification_with(ROLE_GRANT_REVOKE_NOTIFICATION_METHOD, (p) => p.role_grant_id === role_grant_id), 5000);
+                const is_revoke_frame = is_notification_with(ROLE_GRANT_REVOKE_NOTIFICATION_METHOD, (p) => p.role_grant_id === role_grant_id);
                 // Flat params — guards the no-`offer`-wrapper, `revoked_by`-omitted
                 // shape against drift.
-                const params = RoleGrantRevokeParams.parse(frame.params);
-                assert.strictEqual(params.role_grant_id, role_grant_id);
-                assert.strictEqual(params.role, ROLE_ADMIN);
-                assert.strictEqual(params.reason, 'cleanup');
-                assert.notProperty(frame.params, 'revoked_by');
+                const assert_flat_revoke = (frame) => {
+                    const params = RoleGrantRevokeParams.parse(frame.params);
+                    assert.strictEqual(params.role_grant_id, role_grant_id);
+                    assert.strictEqual(params.role, ROLE_ADMIN);
+                    assert.strictEqual(params.reason, 'cleanup');
+                    assert.notProperty(frame.params, 'revoked_by');
+                };
+                if (revoke_closes_the_socket) {
+                    // the socket lost the role its endpoint requires; the revoke
+                    // notification may land just ahead of the close or not at all,
+                    // and is held to the same shape when it does
+                    const closed = await revokee_ws.wait_for_close(5000);
+                    assert.ok(closed, 'the gated socket did not close after the revoke');
+                    assert.strictEqual(revokee_ws.close_code, WS_CLOSE_PERMISSION_REVOKED);
+                    const early = revokee_ws.messages.find(is_revoke_frame);
+                    if (early)
+                        assert_flat_revoke(early);
+                    return;
+                }
+                assert_flat_revoke(await revokee_ws.wait_for(is_revoke_frame, 5000));
             }
             finally {
                 await revokee_ws.close();
@@ -240,7 +249,9 @@ export const describe_role_grant_offer_notification_ws_tests = (options) => {
             const fixture = await setup_test();
             const grantor = await fixture.create_account({ roles: [ROLE_ADMIN] });
             const revokee = await fixture.create_account({ roles: [ROLE_ADMIN] });
-            const role_grant_id = await create_active_role_grant(fixture, revokee);
+            const role_grant_id = await create_active_role_grant(fixture, revokee, {
+                rpc_path: RPC_PATH
+            });
             // A *pending* sibling offer for the same (account, role) — this is what
             // the revoke cascade supersedes.
             const sibling_offer = await create_pending_offer(fixture, revokee.account.id, grantor.create_session_headers());

package/dist/testing/cross_backend/role_grant_participation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_participation.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_participation.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,WAAW,sCAAsC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,6CAA6C,GACzD,SAAS,sCAAsC,KAC7C,IA8IF,CAAC"}
+{"version":3,"file":"role_grant_participation.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_participation.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,WAAW,sCAAsC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,6CAA6C,GACzD,SAAS,sCAAsC,KAC7C,IAuQF,CAAC"}

package/dist/testing/cross_backend/role_grant_participation.js

@@ -15,6 +15,15 @@ import '../assert_dev_env.js';
  *   re-assigning the active grant is idempotent (same id).
  * - **consent flow** — `role_grant_offer_create` of `participant` (admin-only)
  *   → the recipient `role_grant_offer_accept`s → a role_grant lands.
+ * - **offer replay** — re-accepting an accepted offer whose grant still
+ *   stands answers `200` with the same `role_grant_id` and writes no audit
+ *   row; once the grant is revoked, the replay is refused `invalid_request`
+ *   with reason `role_grant_offer_terminal` (never the revoked grant's id).
+ * - **no self-offer, in either case** — an admin offering to its own
+ *   account is refused `invalid_params` with reason
+ *   `role_grant_offer_self_target`, whether the id is sent lowercase or
+ *   uppercase: both spines canonicalize the id before comparing it with the
+ *   grantor's account.
  * - **scoped assign** — `role_grant_assign` of `participant` with a paired
  *   `scope_kind` + `scope_id` lands a scoped grant carrying both, read back
  *   through `admin_account_list`, distinct from the global grant.
@@ -32,6 +41,9 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { rpc_call } from '../rpc_helpers.js';
+import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
+import { ERROR_ROLE_GRANT_OFFER_SELF_TARGET, ERROR_ROLE_GRANT_OFFER_TERMINAL } from '../../auth/role_grant_offer_action_specs.js';
+import { JSONRPC_INVALID_PARAMS, JSONRPC_INVALID_REQUEST } from '../../http/jsonrpc.js';
 import { SPINE_PARTICIPANT_ROLE, SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_role_grant_participation_cross_tests = (options) => {
     const { setup_test } = options;
@@ -100,5 +112,57 @@ export const describe_role_grant_participation_cross_tests = (options) => {
             assert.ok(accepted.ok, `accept must succeed: ${JSON.stringify(accepted)}`);
             assert.ok(typeof accepted.result.role_grant_id === 'string', 'accept lands a role_grant for the app-role');
         });
+        /** Offer `participant` to `recipient` as the keeper and accept it; returns the ids. */
+        const offer_and_accept = async (fixture, recipient) => {
+            const created = await rpc(fixture.transport, 'role_grant_offer_create', { to_account_id: recipient.account.id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+            assert.ok(created.ok, `offer create must succeed: ${JSON.stringify(created)}`);
+            const offer_id = created.result.offer.id;
+            const accepted = await rpc(fixture.fresh_transport(), 'role_grant_offer_accept', { offer_id }, recipient.create_session_headers());
+            assert.ok(accepted.ok, `accept must succeed: ${JSON.stringify(accepted)}`);
+            const { role_grant_id } = accepted.result;
+            return { offer_id, role_grant_id };
+        };
+        /** How many `event_type` audit rows the keeper can list. */
+        const count_audit_rows = async (fixture, event_type) => {
+            const listed = await rpc(fixture.transport, 'audit_log_list', { event_type }, fixture.create_session_headers());
+            assert.ok(listed.ok, `audit_log_list must succeed: ${JSON.stringify(listed)}`);
+            return AuditLogListOutput.parse(listed.result).events.length;
+        };
+        test('re-accepting an accepted offer answers the same grant and writes no audit row', async () => {
+            const fixture = await setup_test();
+            const recipient = await fixture.create_account({ username: 'participation_replayer' });
+            const { offer_id, role_grant_id } = await offer_and_accept(fixture, recipient);
+            const accept_rows = await count_audit_rows(fixture, 'role_grant_offer_accept');
+            const create_rows = await count_audit_rows(fixture, 'role_grant_create');
+            assert.ok(accept_rows >= 1, 'the accept itself is audited');
+            const replayed = await rpc(fixture.fresh_transport(), 'role_grant_offer_accept', { offer_id }, recipient.create_session_headers());
+            assert.ok(replayed.ok, `a replay of a held grant must succeed: ${JSON.stringify(replayed)}`);
+            assert.strictEqual(replayed.result.role_grant_id, role_grant_id, 'a replay answers the grant the accept minted');
+            assert.strictEqual(await count_audit_rows(fixture, 'role_grant_offer_accept'), accept_rows, 'a replay writes no role_grant_offer_accept row');
+            assert.strictEqual(await count_audit_rows(fixture, 'role_grant_create'), create_rows, 'a replay writes no role_grant_create row');
+        });
+        test('re-accepting an offer whose grant was revoked is refused as terminal', async () => {
+            const fixture = await setup_test();
+            const recipient = await fixture.create_account({ username: 'participation_revoked' });
+            const { offer_id, role_grant_id } = await offer_and_accept(fixture, recipient);
+            const revoked = await rpc(fixture.transport, 'role_grant_revoke', { actor_id: recipient.actor.id, role_grant_id }, fixture.create_session_headers());
+            assert.ok(revoked.ok, `revoke must succeed: ${JSON.stringify(revoked)}`);
+            const replayed = await rpc(fixture.fresh_transport(), 'role_grant_offer_accept', { offer_id }, recipient.create_session_headers());
+            assert.ok(!replayed.ok, `a replay after revoke must be refused: ${JSON.stringify(replayed)}`);
+            assert.strictEqual(replayed.status, 400);
+            assert.strictEqual(replayed.error.code, JSONRPC_INVALID_REQUEST);
+            assert.deepStrictEqual(replayed.error.data, { reason: ERROR_ROLE_GRANT_OFFER_TERMINAL });
+        });
+        test('an admin offering to its own account is refused, whatever the id case', async () => {
+            const fixture = await setup_test();
+            const own_id = fixture.account.id;
+            for (const to_account_id of [own_id, own_id.toUpperCase()]) {
+                const res = await rpc(fixture.transport, 'role_grant_offer_create', { to_account_id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+                assert.ok(!res.ok, `a self-offer must be refused (${to_account_id}): ${JSON.stringify(res)}`);
+                assert.strictEqual(res.status, 400, to_account_id);
+                assert.strictEqual(res.error.code, JSONRPC_INVALID_PARAMS, to_account_id);
+                assert.deepStrictEqual(res.error.data, { reason: ERROR_ROLE_GRANT_OFFER_SELF_TARGET }, to_account_id);
+            }
+        });
     });
 };

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAuBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -61,9 +61,10 @@ export const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = 'FUZ_RUST_SPINE_STUB_EXP
  * plus `sse` (the stub serves `GET /api/admin/audit/stream` over the spine
  * `fuz_realtime::SseRegistry` + audit listener), `ready` (it live-mounts
  * `/ready` over the env-supplied fixture path), `ws_account_actions` (it
- * serves one action registry on `/api/rpc` and `/api/ws`), and
- * `cell_gated_create` (it
- * mounts the `TestCellGatedCreateAuthorize` policy on its cell layer). Named
+ * serves one action registry on `/api/rpc` and `/api/ws`), `cell_gated_create`
+ * (it mounts the `TestCellGatedCreateAuthorize` policy on its cell layer), and
+ * `ws_role_gated` (it mounts the role-gated WS endpoint at
+ * `SPINE_ROLE_GATED_WS_PATH`, sharing its connection registry). Named
  * (not inline) so every spine preset is greppable, mirroring
  * `ts_spine_capabilities`.
  */
@@ -72,7 +73,8 @@ const rust_spine_stub_capabilities = Object.freeze({
     sse: true,
     ready: true,
     ws_account_actions: true,
-    cell_gated_create: true
+    cell_gated_create: true,
+    ws_role_gated: true
 });
 /** Default listening port — slots beside zzz's 1175/1176; matches the binary's `DEFAULT_PORT`. */
 export const RUST_SPINE_STUB_DEFAULT_PORT = 1177;

package/dist/testing/cross_backend/spine_surface_constants.d.ts

@@ -51,9 +51,28 @@ export declare const SPINE_CELL_EDITOR_ROLE = "cell_editor";
  * bootstrap-seed-only cell role.
  */
 export declare const SPINE_PARTICIPANT_ROLE = "participant";
+/**
+ * Mount path of the spine binaries' second, role-gated WebSocket endpoint —
+ * the same actions as the ungated `/api/ws`, behind
+ * `SPINE_ROLE_GATED_WS_ROLES`. Both spines mount it (the TS binary sharing
+ * `/api/ws`'s transport, the Rust stub its connection registry), so one
+ * account can hold a gated and an ungated socket side by side. Driven by
+ * `describe_ws_role_gated_cross_tests`, behind `capabilities.ws_role_gated`.
+ * Must match the Rust `testing_spine_stub`'s gated mount — a cross-language
+ * test contract.
+ */
+export declare const SPINE_ROLE_GATED_WS_PATH = "/api/gated/ws";
+/**
+ * The roles `SPINE_ROLE_GATED_WS_PATH` requires, any-of: `admin`, the gate a
+ * privileged-broadcast socket uses, and `participant`, a role that can be
+ * granted scoped — so the suite can revoke a scoped grant of a listed role
+ * and see nothing close. Must match the Rust `testing_spine_stub`'s gated
+ * mount.
+ */
+export declare const SPINE_ROLE_GATED_WS_ROLES: ReadonlyArray<string>;
 /**
  * Committed expected-schema fixture for the spine `/ready` deploy gate — the
- * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)
+ * column map a fresh full spine bootstrap (auth + cell + fact)
  * produces. Resolved relative to this module so the spawned TS binary (which
  * imports this source under its loader) reads it off disk via `node:fs`.
  * Regenerated + guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`.

package/dist/testing/cross_backend/spine_surface_constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}
+{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAG1D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}